> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-workload-identity-keyless.md). # GCP Workload Identity (Keyless) ## About Google Cloud and GKE You can connect Google Cloud to OX using Workload Identity Federation to scan and monitor your Google Cloud resources without creating or maintaining a long-lived service account key. You can connect a single Google Cloud project or an entire Google Cloud organization. Both options use Workload Identity Federation. If you use Google Kubernetes Engine (GKE), you can also connect your GKE clusters after configuring the GCP connection. Complete the Google Cloud configuration from Cloud Shell or a local shell using `gcloud`, and then complete the connection in OX. ### Choose a connection scope Choose the connection scope based on the Google Cloud resources that you want OX to access.
Connection scopeDescription
Single projectConnect the resources of one Google Cloud project. The required roles are granted to the service account for that project.
Entire organizationConnect every project under a Google Cloud organization. The required roles are granted once at the organization level and inherited by the projects.
## Roles granted to OX OX uses nine read-only Google Cloud roles to access the resources required for scanning. These roles define the extent of OX's access to your Google Cloud resources. | Role ID | Description | | ----------------------------------------- | ------------------------------------------------------------------------ | | `roles/viewer` | Provides baseline read access to project resources. | | `roles/iam.securityReviewer` | Provides read access to IAM policies and security configuration. | | `roles/storage.objectViewer` | Provides read access to Cloud Storage object metadata and contents. | | `roles/accessapproval.viewer` | Provides read access to Access Approval settings. | | `roles/accesscontextmanager.policyReader` | Provides read access to VPC Service Controls policies. | | `roles/discoveryengine.viewer` | Provides read access to Vertex AI Search and Discovery Engine resources. | | `roles/firebaserules.viewer` | Provides read access to Firebase security rules. | | `roles/firebase.viewer` | Provides read access to Firebase project configuration. | | `roles/healthcare.datasetViewer` | Provides read access to Healthcare API dataset metadata. | ## Troubleshooting | Issue | Resolution | | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Policy modification fails when you run `gcloud alpha iam policies lint-condition`. | Retry the binding. Concurrent policy writes are the usual cause. Run the command again with `--verbosity=debug` and look for `setIamPolicy ... 200`, which indicates that the policy was applied. If the issue continues, check for a domain-restricted-sharing constraint. | | `PERMISSION_DENIED` when you run `gcloud organizations add-iam-policy-binding`. | Organization-level bindings require `roles/resourcemanager.organizationAdmin`. A user with this role in your organization must perform the organization-level role assignment. | | `PERMISSION_DENIED` when you run `gcloud services enable`. | Grant `roles/serviceusage.serviceUsageAdmin` at the organization level to the user performing the configuration. | | Individual projects fail during API enablement. | Projects with billing disabled are expected to fail and remain out of scope. The API enablement loop prints a check for each project and continues processing the remaining projects. After resolving the issue for a project that you want OX to scan, run the API enablement step again. | | OX discovers fewer projects than expected. | Verify that `cloudresourcemanager.googleapis.com` is enabled in each project and that the required organization-level role bindings are configured. OX uses Cloud Resource Manager to discover projects. | | `gcloud projects list` doesn't return any projects. | Sign in again using `gcloud auth login` and verify that your account has the `resourcemanager.projects.list` permission. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-workload-identity-keyless.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.